Monitoring employees under GDPR is lawful in the EU and UK, but buying a tool is not a lawful basis on its own. You need a legitimate purpose, a proportionality assessment (usually a DPIA), transparent notice to staff, and genuine data minimisation. This checklist walks through each step.
If you employ people in the EU, EEA, or UK, U.S. monitoring norms don't transfer. GDPR treats employee monitoring as processing of personal data, which means you need a defensible legal footing before you deploy — not after. The good news: a privacy-first, activity-only approach makes the assessment much easier to pass.
This is the EU/UK companion to our U.S. state guide.
The checklist
1. Establish a lawful basis (not consent)
You need one of the GDPR Article 6 bases. In employment, legitimate interests is the practical choice. Consent usually isn't valid because employees can't freely refuse their employer. Document the legitimate interest and the balancing test against employees' rights.
2. Run the necessity & proportionality test
Ask: is monitoring necessary for the stated purpose, and is it the least intrusive way to achieve it? This is where measuring activity metadata (focus, app categories) rather than content (keystrokes, messages) wins — it's far easier to argue proportionate.
3. Complete a DPIA where required
A Data Protection Impact Assessment is expected for systematic monitoring of employees. It documents the data collected, the risks, and the mitigations. Keep it on file.
4. Be transparent
Tell employees what you collect, why, the lawful basis, retention, and their rights — in clear language, before monitoring starts. The UK ICO is explicit that workers should not be monitored covertly except in rare, justified cases.
5. Minimise and retain briefly
Collect only what you need and keep it only as long as necessary. ProdView's 7-day default retention on lower tiers and category-level data are examples of minimisation in practice.
6. Honour data-subject rights
Employees can request access to and, in some cases, deletion of their data. Make sure your tooling can support those requests.
Why "measure less" is your compliance shortcut
Every GDPR requirement rewards the same instinct: collect less, be transparent, and keep it short. A tool that records screens and keystrokes forces you to justify a lot. A tool that records that Figma was in focus for two hours — and shows the employee the same number — clears the proportionality bar with room to spare.
That's the whole design philosophy behind ProdView, and it's why the privacy-first approach isn't just nicer — it's less legal work. More on that in time tracking without screenshots.
General information, not legal advice. Confirm with your DPO or counsel before deploying monitoring in the EU/UK.